<html>
<head><meta charset="utf-8"><title>rustsec crates and rust-audit · wg-secure-code · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/index.html">wg-secure-code</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/rustsec.20crates.20and.20rust-audit.html">rustsec crates and rust-audit</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="205452289"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/rustsec%20crates%20and%20rust-audit/near/205452289" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/rustsec.20crates.20and.20rust-audit.html#205452289">(Jul 30 2020 at 08:16)</a>:</h4>
<p><span class="user-mention" data-user-id="132721">@Tony Arcieri</span> I'm working on the implementation of the <a href="https://github.com/rust-lang/rfcs/pull/2801">Cargo version embedding RFC</a> as a <a href="https://github.com/Shnatsel/rust-audit">crate</a>. Among other things I need to load Cargo.lock, strip out source information and convert it to JSON, then load that JSON into the same structure. I was going to use the <code>cargo-lock</code> crate. Any tips on the cleanest way to implement that?</p>



<a name="205543439"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/rustsec%20crates%20and%20rust-audit/near/205543439" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/rustsec.20crates.20and.20rust-audit.html#205543439">(Jul 30 2020 at 23:15)</a>:</h4>
<p>Interop with the cargo-lock crate data structures is highly desirable, since I want this to be simply another source of data for cargo-audit</p>



<a name="205614546"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/rustsec%20crates%20and%20rust-audit/near/205614546" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/rustsec.20crates.20and.20rust-audit.html#205614546">(Jul 31 2020 at 16:56)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span> if you'd like to add an optional <code>serde_json</code> dependency to <code>cargo-lock</code>, I'd be fine with that</p>



<a name="205614613"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/rustsec%20crates%20and%20rust-audit/near/205614613" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/rustsec.20crates.20and.20rust-audit.html#205614613">(Jul 31 2020 at 16:57)</a>:</h4>
<p>it uses internal <code>serde</code> encoding types ala <code>cargo</code> itself so I think you'd need some minimal integration inside <code>cargo-lock</code></p>



<a name="205615936"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/rustsec%20crates%20and%20rust-audit/near/205615936" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/rustsec.20crates.20and.20rust-audit.html#205615936">(Jul 31 2020 at 17:09)</a>:</h4>
<p>Yeah that's what I was thinking. Any tips on how to deal with the source info not being present? Right now all data structures assume it's there. Should I make it an empty string, or refactor into an Option, or something else entirely?</p>



<a name="205616105"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/rustsec%20crates%20and%20rust-audit/near/205616105" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/rustsec.20crates.20and.20rust-audit.html#205616105">(Jul 31 2020 at 17:11)</a>:</h4>
<p>we could make it an <code>Option</code> I guess. also I see I actually implemented everything in terms of serde traits, so if you did make it an empty string it should just work with <code>serde_json</code> out-of-the-box</p>



<a name="205616493"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/rustsec%20crates%20and%20rust-audit/near/205616493" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/rustsec.20crates.20and.20rust-audit.html#205616493">(Jul 31 2020 at 17:14)</a>:</h4>
<p>Let me see if there a quick-and-easy way to skip a certain field when encoding/decoding JSON only, not TOML</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>